CVE-2026-25480

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25480
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0 Release Notes
https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca Patch
https://github.com/litestar-org/litestar/releases/tag/v2.20.0 Release Notes
https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:litestar:litestar:*:*:*:*:*:*:*:*
History

17 Feb 2026, 15:12

Type Values Removed Values Added
References () https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0 - () https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0 - Release Notes
References () https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca - () https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca - Patch
References () https://github.com/litestar-org/litestar/releases/tag/v2.20.0 - () https://github.com/litestar-org/litestar/releases/tag/v2.20.0 - Release Notes
References () https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg - () https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg - Exploit, Vendor Advisory
CPE cpe:2.3:a:litestar:litestar:*:*:*:*:*:*:*:*
Summary
  • (es) Litestar es un framework de Interfaz de Pasarela de Servidor Asíncrono (ASGI). Antes de la versión 2.20.0, FileStore mapea las claves de caché a nombres de archivo utilizando la normalización Unicode NFKD y la sustitución ord() sin separadores, creando colisiones de claves. Cuando FileStore se utiliza como backend de caché de respuestas, un atacante remoto no autenticado puede desencadenar colisiones de claves de caché a través de rutas manipuladas, haciendo que una URL sirva respuestas en caché de otra (envenenamiento/mezcla de caché). Esta vulnerabilidad está corregida en la versión 2.20.0.
First Time Litestar litestar
Litestar

09 Feb 2026, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-09 20:15

Updated : 2026-02-17 15:12

NVD link : CVE-2026-25480

Mitre link : CVE-2026-25480

CVE.ORG link : CVE-2026-25480

JSON object : View

Products Affected

litestar

  • litestar
CWE
CWE-176

Improper Handling of Unicode Encoding